Cisco AAA commands: shutdown or config-register changes to boot into alternate modes

ATT&CK techniques

Impact

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags Cisco AAA activity where commands include shutdown or specific config-register values associated with alternate boot behavior. Such actions can disrupt availability or alter system startup mode, which may help an attacker impact operations or manipulate device state. It relies on keyword matches in AAA service logs for the listed command fragments.

Reporting behind it

github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/network/cisco/aaa/cisco_cli_dos.yml

Related detections9 linkedT1565.001 — drag to rearrange

Linux auditd: Detect writes to /proc/sysrq-trigger or sysrq-related config for Magic SysRq abuse

Linux Process Creation: ESXi esxcli VM kill via vm process kill flags

Linux process-created writes to sensitive or critical files via shell redirection or editors

Windows Suspicious Use of shutdown.exe to Log Off a User

Linux Shell History File Deletion via rm/unlink/shred

Windows Suspicious Shutdown or Reboot via shutdown.exe Command-Line

Linux Commands Clearing or Removing /var/log/syslog

Azure Activity Logs: Device or Device Configuration Modified or Deleted

Azure Activity Logs: DNS Zone Write or Delete Operations

Cisco AAA commands: shutdown or config-register changes to boot into alternate modes

Pivot detection · T1565.001 · 9 related

Changelog

v2

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

cisco-aaa-commands-triggering-shutdown-or-boot-mode-via-config-register-values-d94a35f0

title: "Cisco AAA commands: shutdown or config-register changes to boot into alternate modes"
id: ca19c475-09a2-4067-be33-1b6472f2058a
status: test
description: This rule flags Cisco AAA activity where commands include shutdown or specific config-register values associated with alternate boot behavior. Such actions can disrupt availability or alter system startup mode, which may help an attacker impact operations or manipulate device state. It relies on keyword matches in AAA service logs for the listed command fragments.
author: Austin Clark, Huntrule Team
date: 2019-08-15
modified: 2023-01-04
tags:
  - attack.impact
  - attack.t1495
  - attack.t1529
  - attack.t1565.001
logsource:
  product: cisco
  service: aaa
detection:
  keywords:
    - shutdown
    - config-register 0x2100
    - config-register 0x2142
  condition: keywords
falsepositives:
  - Legitimate administrators may run these commands, though rarely.
level: medium
license: DRL-1.1
related:
  - id: d94a35f0-7a29-45f6-90a0-80df6159967c
    type: derived
references:
  - https://github.com/SigmaHQ/sigma/blob/master/rules/network/cisco/aaa/cisco_cli_dos.yml

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL